Update docs for new commands, shell flags, and encrypt toggle

- CLI reference: Add vault:delete and env:remove command docs
- Shell reference: Add unmask flag to history, import command with
  overwrite/skip-existing/dry-run flags, copy overwrite/dry-run flags
- Configuration guide: Add vault deletion and env removal sections
- Web UI docs: Document encrypt toggle on create/edit dialog

Author: jszobody

docs/WEB_UI.md

@@ -29,6 +29,7 @@ The server generates a secure token on startup and automatically injects it into
 The main Secrets view provides:
 - **Table view** of all secrets with key, value (masked), and modification date
 - **Search** with real-time filtering
+- **Encrypt toggle** when creating or editing secrets (on by default)
 - **Quick actions** menu for each secret:
   - Edit value
   - Rename key

docs/guide/cli/reference.md

@@ -47,6 +47,31 @@ List all configured vaults.
 keep vault:list
 ```
 
+## `keep vault:delete`
+
+Delete a vault configuration.
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `--force` | boolean | `false` | Delete without confirmation |
+
+**Arguments:**
+- `[vault]` - Vault slug to delete (prompted if not provided)
+
+**Examples:**
+```bash
+# Interactive deletion
+keep vault:delete
+
+# Delete specific vault
+keep vault:delete my-vault
+
+# Force delete without prompt
+keep vault:delete my-vault --force
+```
+
+**Note:** The default vault cannot be deleted. Change the default vault first with `keep init`. Deleting a vault only removes the local Keep configuration — secrets in the remote vault are not affected.
+
 ## `keep env:add`
 
 Add a custom env/environment beyond the standard ones (local, staging, production).
@@ -80,6 +105,31 @@ keep env:add sandbox --no-interaction
 - Can contain letters, numbers, hyphens, and underscores
 - Examples: `qa`, `demo`, `integration`, `sandbox`, `dev2`, `staging-eu`
 
+## `keep env:remove`
+
+Remove a custom environment.
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `--force` | boolean | `false` | Remove without confirmation |
+
+**Arguments:**
+- `[name]` - Environment name to remove (prompted if not provided)
+
+**Examples:**
+```bash
+# Interactive removal
+keep env:remove
+
+# Remove specific environment
+keep env:remove integration
+
+# Force remove without prompt
+keep env:remove qa --force
+```
+
+**Note:** System environments (local, staging, production) cannot be removed. Removing an environment only updates the local Keep settings — secrets in remote vaults are not affected.
+
 ## `keep workspace`
 
 Personalize your workspace by filtering which vaults and envs appear in commands and UI.

docs/guide/configuration.md

@@ -108,6 +108,17 @@ keep set API_KEY "integration-key" --env=integration
 keep copy --only="*" --from=local --to=integration
 ```
 
+### Remove Custom Environments
+
+You can remove custom environments you've added:
+
+```bash
+keep env:remove integration
+keep env:remove qa --force  # Skip confirmation
+```
+
+System environments (local, staging, production) cannot be removed.
+
 ## Add a Vault
 
 ```bash
@@ -121,6 +132,17 @@ Follow the prompts to configure AWS SSM or Secrets Manager access. After adding
 
 **Note:** AWS credentials must be configured separately from your application secrets. See [AWS Authentication](/guide/aws-authentication) for setup instructions.
 
+### Remove a Vault
+
+You can delete vault configurations if they're no longer needed:
+
+```bash
+keep vault:delete
+keep vault:delete my-vault --force  # Skip confirmation
+```
+
+This only removes the local Keep configuration — secrets in the remote vault are not affected. The default vault cannot be deleted.
+
 ## Verify Setup
 
 After configuration, verify your access:

docs/guide/shell/reference.md

@@ -121,6 +121,8 @@ History for secret: API_KEY
 │ 2       │ sk_o****   │ String   │ 2024-01-10 14:22:00 │ admin        │
 │ 1       │ sk_t****   │ String   │ 2024-01-05 09:15:00 │ admin        │
 └─────────┴────────────┴──────────┴─────────────────────┴──────────────┘
+
+>>> history API_KEY unmask  # Show actual values
 ```
 
 **search** - Search for secrets by value
@@ -149,6 +151,9 @@ Found 3 secrets containing "postgres":
 >>> copy API_KEY production
 ✓ Copied API_KEY to production
 
+>>> copy API_KEY production overwrite  # Overwrite if exists
+>>> copy API_KEY production dry-run    # Preview without copying
+
 >>> copy only DB_* staging
 ✓ Copied 3 secrets matching DB_* to staging
 
@@ -194,7 +199,16 @@ Summary:
 # Quick env format export
 ```
 
-Note: The `import` command is only available in the CLI, not the shell.
+**import** - Import secrets from .env file
+```bash
+>>> import .env
+# Imports secrets from file
+
+>>> import .env overwrite      # Overwrite existing secrets
+>>> import .env skip-existing  # Skip existing secrets
+>>> import .env dry-run        # Preview without importing
+>>> import .env dry-run overwrite  # Flags can be combined in any order
+```
 
 ### Verification
 
@@ -304,7 +318,7 @@ Secret Management
   set <key> <value>        Set a secret (alias: s)
   delete <key> [force]     Delete a secret (alias: d)
   show [unmask]            Show all secrets (alias: ls)
-  history <key>            View secret history
+  history <key> [unmask]    View secret history
   rename <old> <new>       Rename a secret
   search <query>           Search for secrets containing text
   copy <key> [destination] Copy single secret
@@ -317,7 +331,8 @@ Context Management
   use <vault:env>          Switch both vault and env (alias: u)
   context                  Show current context (alias: ctx)
 
-Analysis & Export
+Import, Export & Analysis
+  import <file> [flags]    Import secrets from .env file
   export                   Export secrets interactively
   verify                   Verify vault setup and permissions
   info                     Show Keep information
@@ -419,9 +434,9 @@ Many commands become interactive when arguments are omitted:
 
 ### CLI-Only Commands
 These commands are not available in the shell:
-- `import` - Use the CLI: `keep import file.env`
-- `push` / `pull` - Use the CLI for bulk operations
 - `init` - Use the CLI: `keep init`
+- `vault:add` / `vault:edit` / `vault:delete` - Use the CLI for vault management
+- `env:add` / `env:remove` - Use the CLI for environment management
 
 ### Security Notes
 - The shell masks secret values by default using `****` or showing only first 4 characters

docs/guide/web-ui/features.md

@@ -6,6 +6,7 @@ The Secrets page provides full CRUD operations with real-time search and filteri
 
 **Key capabilities:**
 - Create, edit, rename, and delete secrets
+- Encryption toggle — choose whether to encrypt each secret (on by default)
 - Copy secrets between environments and vaults
 - View revision history
 - Bulk import from `.env` files